PHP2Shell: October's Emergency PHP Release Fixes Two Remote Code Execution Bugs
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two unauthenticated RCE bugs in PHP itself. What's affected and how to update.
Emyrix Blog
#patches
Every post tagged patches, newest first.
APSB26-153: October's Magento Patch Closes a Way Around the StyleSmuggler Fix
Adobe's October 2026 Magento patch fixes CVE-2026-103849, a 10.0 template injection Sansec says gets past September's StyleSmuggler hotfix. You need both.
APSB26-138: September's Magento Patch Doesn't Contain the Zero-Day Fix
Adobe shipped two Magento security patches a day apart in September 2026, and the monthly one doesn't include the emergency fix for CVE-2026-75650. You need both, in order.
APSB26-92: A Magento Account Takeover That Needs No Login
Adobe's August 2026 patch fixes seven Adobe Commerce and Magento vulnerabilities. The worst lets someone take over a customer account without logging in, and attacks started within a day.
Magento 2.4.9 Security Patches: Newest Doesn't Mean Safest
Adobe's July 2026 bulletin listed Magento 2.4.9 among the affected versions. Why the newest release line needs the most patch discipline, not the least.
Magento 2.4.8 Security Patches: The Comfortable Version Is Where Discipline Slips
Magento 2.4.8 is supported to 2028, which makes it easy to defer patching. Adobe's cadence changed in 2026 — here's the patch process that keeps up with it.
Magento 2.4.7 Security Patches: Supported Is Not the Same as Patched
Magento 2.4.7 is still supported until 2027 — but Adobe's July 2026 bulletin lists 2.4.7-p10 and earlier as vulnerable. Why patch level matters more than version number.
Working through one of these?
Talk to us.
Upgrades, performance work, and emergency support for Magento, Adobe Commerce, Shopware, and custom Laravel builds.